Session variables are not cleared correctly when a user logs out

The user_logout code is calling the php function session_destroy, but that alone will not destroy a session, the api session_regenerate() should be used instead because it will remove the cookie from the web browser and replace the old value with the newly generated session id.